Password generator

Why length matters more than complexity rules

A password's resistance to brute-force guessing depends mainly on how many possible combinations it has, which is driven far more by length than by mixing in symbols. A random 16-character password using only lowercase letters is harder to crack than an 8-character password stuffed with symbols and numbers, simply because there are exponentially more 16-character combinations than 8-character ones. Modern guidance from security bodies like NIST has moved away from forcing complex, hard-to-remember rules and toward encouraging longer passwords or passphrases instead.

This tool runs entirely in your browser

Every password shown here is generated locally using your browser's random number generator — nothing is sent to a server, logged, or stored anywhere, including by this site. Closing the tab clears it completely. That said, for anything protecting a real account, using a dedicated password manager to both generate and store your passwords is generally a better long-term habit than generating one here and trying to remember it.

A reasonable default for most accounts today is at least 16 characters using a mix of character types, unless the site you're signing up for has a shorter maximum length — in which case, use the longest one it allows.